Computer help forum: Destructive new virus hosed hard drives, or Dell issue?

Syz,

Haven't heard of these, but possible.

The home computer: by following the on screen instruction the Administrator Password was changed and who knows what elese. Can't use the proper term for this type of attack.

Attempt to boot the drive w/Win98 boot disk.
Use "fdisk" to delete all partions, the try re-install.
Partion Recovery is another utility to try.

System at work: "two techs set-up systems - downloaded e-mail - no anit-virus. One word DUH!! First order of setting up a new system is security. All in place before connection to Network or Internet. I would find new techs.

The H/D's on the two dead systems may need the same proceedure as the home machine.

H/D have been known to fail brand new out of the box.
With the total number of sales dell has in a given day 80 dead H/D's may be the norm or the dead systems partions are total screwed up like yours.

On a bench with the utilities I use a better answer could be given. As a topic this one will generate a lot of interest. And I hope that I given you some good thoughts on this issue.

Bill

Dragon

Had to think on this one.

1. Are you asking if unauthorized access to a system could trigger instructions to prevent boot?

Yes, but what would trigger the instructions?
In this case an e-mail was opened (the trigger).

2. Creating a program allowing X number of password tries before shutdown could be possible.
I will leave this to the software people.

I remember the post and my last thought was to use external h/d rails. Pull the h/d, lock it up, computer is now a door stop.

Did I get close to what you were asking?

Bill

Dragon,

That had to be Win 9x, zero security. Lose the password on XP/2000 M/S suggest re-install. Tho their are 3rd party applications that will find or change passwords allowing access to system.

The administrator password is set on install or thur users in control panel. The administrator has total control of system. Other accounts, Power and Limited, only have partial control of system and what they can do. This is a carry over from th "NT" line used for business to control employee use of computers.

Does this help? Corrections anyone.

Bill

Bill:

Sounds like you could be confusing the different "Administrator" and 'User' accounts or passwords on a computer.

Most (if not all) computers now have a setting(s) in the BIOS to set an 'ADMINISTRATOR' and 'USER' password. THESE passwords allow access to the computer itself. When you turn on the computer, it goes through the P.O.S.T. test (Power On Self Test), then stops and with the black screen that simply says "PASSWORD". If you type it in correctly, the computer boots up normally. These same passwords also do (or don't)allow access to various BIOS settings. I have used this method to keep my son from being able to use the computer.

But these passwords are, or can and should be separate from the passwords of the operating system to allow access to files and user (Power or Limited) accounts and such. Yes Win 98 had almost zero security as far as using passwords are concerned.

I believe that there have been viruses that had the ability to screw up the BIOS. In particular, if a virus writer was able to execute code that would START a flashing of the BIOS, but not finish it, or simply erase the BIOS program, it would make your computer useless. You wouldn't even be able to re-flash it. That is why you need to be EXTREMELY careful when flashing a BIOS program. Gigabyte sells motherboards that have duel BIOS chips so you could restore your machine in such a case.

But I'm not sure of the original problem SYZ is having. It could be that code was received via Email that looked like a virus initally, but then instructed the user to do something that would change the password or destroy or change the BIOS program. If using a Win 98 startup disk doesn't work to get the machine working at a basic level, Syz is probably hosed.

One last thing Syz should try: If he has, or can obtain the manual for the motherboard, find the jumper to reset the BIOS settings to factory default. Short the proper pins (momentarily) to reset the BIOS settings, and MAYBE this will clear things up to let him boot the machine. The Email the daughter downloaded and followed may have somehow changed the BIOS settings, and this is just about the only way to fix it. Also, most BIOS companies (AWARD, and I forget who else) have "emergency" passwords that can bypass any password the user sets and forgets. I have used one once. That is probably how, in another post, the guy at the shop was able to get past a password the user set and forgot.

Sorry for the long post.

Larry Bell

I dont mind long posts.
Yeah, my password was a bios password. If I ever have that kind trouble (screwed up bios), Ill remember what you said, no matter what kind of puter I have. This is interesting stuff.

Download the patch described in the Microsoft article, "MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious Programs (Q824146)" (a 1,508Kb file) for the applicable version of WinXP used and keep it on hand and install before ever accessing the Internet. Should you format and reinstall XP at a later date, then install the patch.

*

Do you really think those "branded" computer builders really care about security after the computer leaves their factories? What they care about is simple ... selling computers to make money!

They leave it up to the buyer to secure what they bought. It is no longer their concern once the computer is bought!

*

Just in case this (changed Admin password but more often, forgotten Admin password) happens, I use the User Account Task - Prevent a forgotten password.

Actually, for small companies, it is not a bad idea to run this on all XP machines and extract the little file from the individual restore diskettes into a CD. You can create a temporary hard disk folder with a sub-folder for each XP machine and then extract the restore files into the respective machine folders. When all the machines have been done, burn the restore folders into a CD and let the boss keep it in the company safe.

To sign in as Administrator without the correct password, just copy the restore file from the relevant machine folder onto a diskette. Log on as Administrator and when XP asks for the password, key in anything or just press Enter and a prompt will ask for the restore disk.

It's been a week since you posted this (perhaps the situation resolved itself)and though I am no expert or IT person I had the same problem on my personal computer EXACTLY as you described. It is a 4 year old Gateway which I am running Windows XP on (after giving up on the installed Windows ME a year or so ago). So most likely it is not a Dell issue. After support insisted it was a virus but could not determine the origin and therefore innoculations were moot at that point I had no other choice than to reinstall the operating system. It is tedious and annoying but at least it isn't sitting there like a big paperweight on my desk. I have had no success with Nortons because it makes my dinky HD run like molasses at startup and obviously a virus snuck in the backdoor. I have had good luck with both Zone Alarm and Zone Alarm Pro as well as EZArmor products which run basically the same. My IT people from work steer clear of Nortons' and have personnally chosen McAfee for their home computers. I wish you luck, know that you are not alone. It must have been a nightmare especially in a work setting.

I would boot from your norton antivirus cd and try to get rid of your virus problem or problems from that process.

I had the same problem with a relative's Dell 1.6 GHZ PC. It had been working fine, then the next day it would not boot, not even in safe mode. The OS was XP Home, with automatic windows updates configured.

This user had been told by Dell she must have had a virus and would need to reformat the HD and reload the OS.

I assumed the system must have had a problem with an update, or possibly XP SP2, so I had the user select "Last Known Good" which resolved the problem.

Two things... When you stated that your Boss' pc was asking for the "administator password", the image in my mind was one of a BIOS password. To me it didn't sound like the machine was even getting to the point that it was trying to run the OS. If that is the case, perhaps the attachment that was opened was some sort of program that interracted with the BIOS and set a password on the BIOS itself. You could try clearing the CMOS with the jumper on the motherboard. If this is a BIOS password, this would not be corrected by formatting the hard drive. This info is stored in the BIOS chip on the motherboard and to the best of my knowledge you would have to use the jumper to clear the BIOS.

Second thing... a few months back I had run the Windows UPdate on my XP Pro (SP1) machine. It reported that there was an updated driver for my ATI display adapter. I installed this updated and after doing so the machine rebooted. When it came back on there was a loud shrilling noise from the tower and then all went black. After that, the machine would post but then the screen would go black and that was that. After doing extensive research I figured out that the driver was for the Win98 OS, not XP (not sure of how they differ).

Not sure if this helps or not, but figured I would share. Good Luck.

I had the same thing happen to me after an up date on my Windows XP Pro machine.Just by luck I had a machine running Mandrake Linux and I hooked it up to it after a few days of trying to recover any lost data by going through everything that Microsoft sugested and no one had seen this before according to the Techs. It couldnt get to boot so I couldnt restore or set it to last good setting. I ended up reformating with the Linux because it was the only machine that would even recognise the disk. No other windows based system wuold see it.
I was running Nortons also. Am now trying out different ones.
P.S.
Anybody wanting to get rid of any of those old hard drives that dont work anymore can drop me a line at glpnet@charter.net

Hi Syz,
This almost sounds like the days of old that hose the MBR or Master Boot Record. Some BIOS's added protection for this in the BIOS. Have you tried to have some one boot oup a DOS diskette with fdisk on it? I think the fdisk /MBR should fix this problem.

The way I load systems is to first load the OS, then load the AV software bringing the latest defs over on a CD, then apply any security updates, etc. If you use Ghost, I create a ghost image here, so that I can recover a basic barebone system.

Only at this point will I load applications. I have had great success installing systems in this manner. Particluarly with new virus/worms appearing regularly.

Hope this helps.
Euwell